Priority MEDIUM 40
A privilege escalation vulnerability in Apache OFBiz allows a low-privileged authenticated user to obtain higher privileges This issue affects Apache OFBiz: before 24.09.07.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00407 · Published 2026-06-10 · Fixed in 24.09.07 CWE-285
Priority MEDIUM 41
Improper Control of Generation of Code ('Code Injection') vulnerability in Apache OFBiz allows a low-privileged authenticated user with Content/DataResource editing privileges to perform template injection attacks that c…
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00657 · Published 2026-06-10 · Fixed in 24.09.07 CWE-94
Priority MEDIUM 41
Improper Control of Generation of Code ('Code Injection'), Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') vulnerability in Apache OFBiz.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00717 · Published 2026-05-19 · Fixed in 24.09.06 CWE-94
Priority HIGH 68
Improper Authentication vulnerability in Apache OFBiz via Password-Change Logic Flaw Leading to Remote Code Execution This issue affects Apache OFBiz: before 24.09.06.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.21264 · Published 2026-05-19 · Fixed in 24.09.06 CWE-287
Priority LOW 35
Improper Authorization vulnerability in Apache OFBiz Webtools.
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.00513 · Published 2026-05-19 · Fixed in 24.09.06 CWE-285
Priority MEDIUM 48
Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Apache OFBiz.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00454 · Published 2026-05-19 · Fixed in 24.09.06 CWE-90
Priority LOW 31
Improper Control of Generation of Code ('Code Injection') vulnerability in email services of Apache OFBiz.
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.00497 · Published 2026-05-19 · Fixed in 24.09.06 CWE-94
Priority MEDIUM 48
Use of Hard-coded Cryptographic Key vulnerability in Apache OFBiz.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00436 · Published 2026-05-19 · Fixed in 24.09.06 CWE-321
Priority LOW 39
Server-Side Request Forgery (SSRF) vulnerability in Apache OFBiz.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.0046 · Published 2026-05-19 · Fixed in 24.09.06 CWE-918
Priority LOW 39
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache OFBiz.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00486 · Published 2026-05-19 · Fixed in 24.09.06 CWE-200
Priority LOW 28
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache OFBiz.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.0044 · Published 2026-05-19 · Fixed in 24.09.06 CWE-79
Priority LOW 30
Improper Access Control vulnerability in Apache OFBiz in multi-tenant deployments.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00416 · Published 2026-05-19 · Fixed in 24.09.06 CWE-284
Priority LOW 31
Improper Authentication vulnerability in Apache OFBiz.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00515 · Published 2026-05-19 · Fixed in 24.09.06 CWE-287
Priority LOW 35
Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') vulnerability in Apache OFBiz.
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.00487 · Published 2026-05-19 · Fixed in 24.09.06 CWE-917
Priority LOW 28
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Control of Generation of Code ('Code Injectio…
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00588 · Published 2026-05-19 · Fixed in 24.09.06 CWE-22
Priority LOW 36
Improper Input Validation vulnerability in Apache OFBiz.
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.00574 · Published 2026-05-19 · Fixed in 24.09.06 CWE-20
Priority LOW 39
Server-Side Request Forgery (SSRF) vulnerability in Apache OFBiz via Content component operations.
CVSS 3.1HIGH 7.3· Network · No auth · No interaction · EPSS 0.00473 · Published 2026-05-19 · Fixed in 24.09.06 CWE-918
Priority LOW 36
Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Apache OFBiz.
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.00541 · Published 2026-05-19 · Fixed in 24.09.06 CWE-1336
Priority LOW 36
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz.
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.00684 · Published 2026-05-19 · Fixed in 24.09.06 CWE-22
Priority LOW 36
Reflected cross-site scripting vulnerability in Apache OFBiz.
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.00834 · Published 2025-11-12 · Fixed in 24.09.03 CWE-79
Priority MEDIUM 42
Unrestricted Upload of File with Dangerous Type vulnerability in Apache OFBiz.
CVSS 3.1HIGH 7.3· Network · No auth · No interaction · EPSS 0.01742 · Published 2025-11-12 · Fixed in 24.09.03 CWE-434
Priority HIGH 66
Improper Control of Generation of Code ('Code Injection') vulnerability leading to a possible RCE in Apache OFBiz scrum plugin.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.28844 · Published 2025-08-15 · Fixed in 24.09.02 CWE-94
Priority MEDIUM 64
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Apache OFBiz.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.67607 · Published 2025-04-01 · Fixed in 18.12.19 CWE-80
Priority LOW 18
Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Apache OFBiz.
CVSS 3.1LOW 3.5· Physical · No auth · No interaction · EPSS 0.0066 · Published 2025-03-10 · Fixed in 18.12.18 CWE-1336
Priority MEDIUM 52
Server-Side Request Forgery (SSRF), Improper Control of Generation of Code ('Code Injection') vulnerability in Apache OFBiz.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01598 · Published 2024-11-18 · Fixed in 18.12.17 CWE-918
Load more
THREATIST.IORead the docs